Cryptanalysis of Self-Shrinking Generator

LZ Yang,KF Chen,XY Wang

DOI: https://doi.org/10.1049/el:20031011

2003-01-01

Electronics Letters

Abstract:A simple cryptanalysis of the self-shrinking generator with very short keystream for the case of unknown connection polynomial is provided. The expected complexity of this cryptanalysis is 2(1.5L) when the length of the LFSR of the generator is L.

What problem does this paper attempt to address?

Characterization of the Least Periods of the Generalized Self-Shrinking Sequences

Amparo Fúster-Sabater

DOI: https://doi.org/10.48550/arXiv.1309.1319

2013-09-05

Abstract:In 2004, Y. Hu and G. Xiao introduced the generalized self-shrinking generator, a simple bit-stream generator considered as a specialization of the shrinking generator as well as a generalization of the self-shrinking generator. The authors conjectured that the family of generalized self-shrinking sequences took their least periods in the set {1, 2, 2**(L-1)}, where L is the length of the Linear Feedback Shift Register included in the generator. In this correspondence, it is proved that the least periods of such generated sequences take values exclusively in such a set. As a straight consequence of this result, other characteristics of such sequences (linear complexity or pseudorandomness) and their potential use in cryptography are also analyzed.

Information Theory
Simple Cellular Automata-Based Linear Models for the Shrinking Generator

Amparo Fúster-Sabater,Dolores de la Gu'\ia-Martínez

DOI: https://doi.org/10.48550/arXiv.1006.1755

2010-06-09

Abstract:Structural properties of two well-known families of keystream generators, Shrinking Generators and Cellular Automata, have been analyzed. Emphasis is on the equivalence of the binary sequences obtained from both kinds of generators. In fact, Shrinking Generators (SG) can be identified with a subset of linear Cellular Automata (mainly rule 90, rule 150 or a hybrid combination of both rules). The linearity of these cellular models can be advantageously used in the cryptanalysis of those keystream generators.

Cryptography and Security,Discrete Mathematics
Algebraic Side-Channel Attacks on KLEIN

ZHAO Xin-jie,GUO Shi-ze,WANG Tao,ZHANG Fan,LIU Huiying,JI Ke-ke

DOI: https://doi.org/10.3969/j.issn.1671-1742.2012.04.001

2012-01-01

Abstract:The security of a lightweight block cipher KLEIN against the algebraic side-channel attack is evaluated by combining algebraic attack with side-channel attack under the Hamming weight leakage model.Firstly,the algebraic representation of KLEIN is given.Then,the Hamming weights of the intermediate states are deduced from analyzing the power leakages and converted into algebraic equations.Finally,the CryptoMinisat solver is applied to solve for the key.Based on three different error tolerant strategies,many physical experiments are conducted on KLEIN under an 8-bit microcontroller and the complexity of the attack is also evaluated.Experiment results show that: the unprotected software implementation of KLEIN is vulnerable to algebraic side-channel attack.Full 64-bit master key of KLEIN can be recovered by analyzing the Hamming weight leakages of the first round under know plaintext/ciphertext scenario and 2 rounds under unknown plaintext/ciphertext scenario.
Linearization of Nonlinear Filter Generators and Its Application to Cryptanalysis of Stream Ciphers

Jianghua Zhong,Dongdai Lin

DOI: https://doi.org/10.1016/j.jco.2015.12.003

IF: 1.333

2016-01-01

Journal of Complexity

Abstract:Nonlinear filter generators are commonly used as keystream generators in stream ciphers. A nonlinear filter generator utilizes a nonlinear filtering function to combine the outputs of a linear feedback shift register (LFSR) to improve the linear complexity of keystream sequences. However, the LFSR-based stream ciphers are still potentially vulnerable to algebraic attacks that recover the key from some keystream bits. Although the known algebraic attacks only require polynomial time complexity of computations, all have their own constraints. This paper uses the linearization of nonlinear filter generators to cryptanalyze LFSR-based stream ciphers. Such a method works for any nonlinear filter generators. Viewing a nonlinear filter generator as a Boolean network that evolves as an automaton through Boolean functions, we first give its linearization representation. Compared to the linearization representation in Limniotis et al. (2008), this representation requires lower spatial complexity of computations in most cases. Based on the representation, the key recoverability is analyzed via the observability of Boolean networks. An algorithm for key recovery is given as well. Compared to the exhaustive search to recover the key, using this linearization representation requires lower time complexity of computations, though it leads to exponential time complexity.
Construction and security analysis of hash algorithm based on stream cipher

Huafei Zhu,Lixin Ran,Yumin Wang

IF: 1.019

1999-01-01

Chinese Journal of Electronics

Abstract:Cryptographic hash functions are very important for cryptographic protocols such as signature scheme and message authentication. Based on the pioneer work of X. Lai et al., a new framework of hash algorithm is developed in this paper. In our hash scheme, an extra pseudorandom keystream generator is not needed which may be more conveniently for practical use. We have proved that the security of the new hash scheme is equivalent to that of feedback shift registers (FSRs) controlled by 2m - bit security keys.
A Constructive Method of Algebraic Attack with Less Keystream Bits

Xiaoyan Zhang,Qichun Wang,Bin Wang,Haibin Kan

DOI: https://doi.org/10.1587/transfun.e94.a.2059

2011-01-01

IEICE Transactions on Fundamentals of Electronics Communications and Computer Sciences

Abstract:In algebraic attack on stream ciphers based on LFSRs, the secret key is found by solving an overdefined system of multivariate equations. There are many known algorithms from different point of view to solve the problem, such as linearization, relinearization, XL and Grobner Basis. The simplest method, linearization, treats each monomial of different degrees as a new variable, and consists of $\\sum_{i=1}^{d}{n \\choose i}$ variables (the degree of the system of equations is denoted by d). Thus it needs at least $\\sum_{i=1}^{d}{n \\choose i}$ equations, i.e. keystream bits to recover the secret key by Gaussian reduction or other. In this paper we firstly propose a concept, called equivalence of LFSRs. On the basis of it, we present a constructive method that can solve an overdefined system of multivariate equations with less keystream bits by extending the primitive polynomial.
Power Analysis Attacks on ECC Randomized Automata

Fan Zhang,Zhijie Jerry Shi

DOI: https://doi.org/10.1109/itng.2007.152

2007-01-01

Abstract:Power analysis can exploit the instantaneous power consumptions of elliptic curve cryptography (ECC) devices and retrieve secret keys. Many countermeasures have been proposed to make ECC implementations secure. One of the approaches is the randomized algorithms proposed by Oswald et al., which combine two scalar point multiplication algorithms and use random variables to decide which algorithm to follow at different stages of the computation. In this paper, we describe a power analysis attack that can break randomized automata proposed by Oswald et al. effectively, even with a small number of power traces
A Scheme to resist Fast Correlation Attack for Word Oriented LFSR based Stream Cipher

Subrata Nandi,Srinivasan Krishnaswamy,Pinaki Mitra

2023-07-05

Abstract:In LFSR-based stream ciphers, the knowledge of the feedback equation of the LFSR plays a critical role in most attacks. In word-based stream ciphers such as those in the SNOW series, even if the feedback configuration is hidden, knowing the characteristic polynomial of the state transition matrix of the LFSR enables the attacker to create a feedback equation over $GF(2)$. This, in turn, can be used to launch fast correlation attacks. In this work, we propose a method for hiding both the feedback equation of a word-based LFSR and the characteristic polynomial of the state transition matrix. Here, we employ a $z$-primitive $\sigma$-LFSR whose characteristic polynomial is randomly sampled from the distribution of primitive polynomials over $GF(2)$ of the appropriate degree. We propose an algorithm for locating $z$-primitive $\sigma$-LFSR configurations of a given degree. Further, an invertible matrix is generated from the key. This is then employed to generate a public parameter which is used to retrieve the feedback configuration using the key. If the key size is $n$- bits, the process of retrieving the feedback equation from the public parameter has a average time complexity $\mathbb{O}(2^{n-1})$. The proposed method has been tested on SNOW 2.0 and SNOW 3G for resistance to fast correlation attacks. We have demonstrated that the security of SNOW 2.0 and SNOW 3G increases from 128 bits to 256 bits.

Cryptography and Security
An Efficient Window-Based Countermeasure to Power Analysis of ECC Algorithms

Fan Zhang,Zhijie Jerry Shi

DOI: https://doi.org/10.1109/ITNG.2008.183

2008-01-01

Abstract:Elliptic curve cryptography (ECC) has been adopted in many systems because it requires shorter keys than traditional public-key algorithms in primary fields. However, power analysis attacks can exploit the power consumption of ECC devices to retrieve secret keys. In this paper, we propose an efficient window-based countermeasure that is secure against existing power analysis attacks. Compared to previous counter- measures, our method has low memory overhead, requiring only a table of w+1 entries when the window size is w bits. It also has better performance than many algorithms that perform one point addition or subtraction for every bit in the scalar.
Revisiting the Concrete Security of Goldreich's Pseudorandom Generator

Jing Yang,Qian Guo,Thomas Johansson,Michael Lentmaier

DOI: https://doi.org/10.48550/arXiv.2103.02668

2021-03-04

Abstract:Local pseudorandom generators are a class of fundamental cryptographic primitives having very broad applications in theoretical cryptography. Following Couteau et al.'s work in ASIACRYPT 2018, this paper further studies the concrete security of one important class of local pseudorandom generators, i.e., Goldreich's pseudorandom generators. Our first attack is of the guess-and-determine type. Our result significantly improves the state-of-the-art algorithm proposed by Couteau et al., in terms of both asymptotic and concrete complexity, and breaks all the challenge parameters they proposed. For instance, for a parameter set suggested for 128 bits of security, we could solve the instance faster by a factor of about $2^{61}$, thereby destroying the claimed security completely. Our second attack further exploits the extremely sparse structure of the predicate $P_5$ and combines ideas from iterative decoding. This novel attack, named guess-and-decode, substantially improves the guess-and-determine approaches for cryptographic-relevant parameters. All the challenge parameter sets proposed in Couteau et al.'s work in ASIACRYPT 2018 aiming for 80-bit (128-bit) security levels can be solved in about $2^{58}$ ($2^{78}$) operations. We suggest new parameters for achieving 80-bit (128-bit) security with respect to our attacks. We also extend the attack to other promising predicates and investigate their resistance.

Cryptography and Security,Information Theory
Cryptanalysis of Short Exponent RSA with Primes Sharing Least Significant Bits

Hung-Min Sun,Mu-En Wu,Ron Steinfeld,Jian Guo,Huaxiong Wang

DOI: https://doi.org/10.1007/978-3-540-89641-8_4

2008-01-01

Abstract:LSBS-RSA denotes an RSA system with modulus primes, p and q , sharing a large number of least significant bits. In ISC 2007 , Zhao and Qi analyzed the security of short exponent LSBS-RSA. They claimed that short exponent LSBS-RSA is much more vulnerable to the lattice attack than the standard RSA. In this paper, we further raise the security boundary of the Zhao-Qi attack by considering another polynomial. Our improvemet supports the result of analogue Fermat factoring on LSBS-RSA, which claims that p and q cannot share more than $\frac{n}{4}$ least significant bits, where n is the bit-length of pq . In conclusion, it is a trade-off between the number of sharing bits and the security level in LSBS-RSA. One should be more careful when using LSBS-RSA with short exponents.
Generalized Cryptanalysis of RSA with Small Public Exponent

Mengce Zheng,Honggang Hu,Zilong Wang

DOI: https://doi.org/10.1007/s11432-015-5325-7

2016-01-01

Science China Information Sciences

Abstract:In this paper, we demonstrate that there exist weak keys in the RSA public-key cryptosystem with the public exponent e = N α ≤ N 0.5. In 1999, Boneh and Durfee showed that when α ≈ 1 and the private exponent d = N β < N 0.292, the system is insecure. Moreover, their attack is still effective for 0.5 < α < 1.875. We propose a generalized cryptanalytic method to attack the RSA cryptosystem with α ≤ 0.5. For $c = \left\lfloor {\frac{{1 - \alpha }}{\alpha }} \right\rfloor $ and e γc ≡ d (mod e c), when γ, β satisfy $\gamma < 1 + \frac{1}{c} - \frac{1}{{2\alpha c}}and\beta < \alpha c + \frac{7}{6} - \alpha \gamma c - \frac{1}{3}\sqrt {6\alpha + 6\alpha c + 1 - 6\alpha \gamma c} $, we can perform cryptanalytic attacks based on the LLL algorithm. The basic idea is an application of Coppersmith’s techniques and we further adapt the technique of unravelled linearization, which leads to an optimized lattice. Our advantage is that we achieve new attacks on RSA with α ≤ 0.5 and consequently, there exist weak keys in RSA for most α.
Probability Method for Cryptanalysis of General Multivariate Modular Linear Equation

HaiJian Zhou,Ping Luo,DaoShun Wang,YiQi Dai

DOI: https://doi.org/10.1007/s11432-009-0159-9

2009-01-01

Science in China Series F Information Sciences

Abstract:Finding the solution to a general multivariate modular linear equation plays an important role in cryptanalysis field. Earlier results show that obtaining a relatively short solution is possible in polynomial time. However, one problem arises here that if the equation has a short solution in given bounded range, the results outputted by earlier algorithms are often not the ones we are interested in. In this paper, we present a probability method based on lattice basis reduction to solve the problem. For a general multivariate modular linear equation with short solution in the given bounded range, the new method outputs this short solution in polynomial time, with a high probability. When the number of unknowns is not too large (smaller than 68), the probability is approximating 1. Experimental results show that Knapsack systems and Lu-Lee type systems are easily broken in polynomial time with this new method.
Cryptanalysis of General Lu-Lee Type Systems

Haijian Zhou,Ping Luo,Daoshun Wang,Yiqi Dai

DOI: https://doi.org/10.1007/978-3-540-79499-8_32

2008-01-01

Abstract:The Lu-Lee public key cryptosystem and Adiga-Shankar's modification are considered to be insecure with cryptanalysis by integer linear programing, since only 2 or 3 unknown message blocks are used in the modular linear equation for encryption procedure. Unfortunately integer linear programming algorithms falls in trouble with more unknowns. In this paper we present a probabilistic algorithm for cryptanalysis of general Lu-Lee type systems with nmessage blocks. The new algorithm is base on lattice reduction and succeeds to break Lu-Lee type systems with up to 68 message blocks.
Generalized self-shrinking sequences on GF(q)

胡予濮,白国强,肖国镇

DOI: https://doi.org/10.3969/j.issn.1001-2400.2001.01.002

2001-01-01

Journal of Xidian University

Abstract:We present a simple key-stream algorithm on GF(q) named thegeneralized self-shrinking generator. B(a), the family of generalized self-shrinking sequences, has a group structure. The correlation between the sequences is quite good. The sequences are balanced within a period. No less than (q-1)/q of the sequences from B(a) have their least periodes of qn-1. No less than (q2-1)/q2 of the sequences from B(a) have their periods of no less than qn-2.
On Grain-Like Small State Stream Ciphers Against Fast Correlation Attacks: Cryptanalysis of Plantlet, Fruit-v2 and Fruit-80

Shichang Wang,Meicheng Liu,Dongdai Lin,Li Ma

DOI: https://doi.org/10.1093/comjnl/bxac016

2022-01-01

Abstract:The fast correlation attack (FCA) is one of the most important cryptanalytic techniques against LFSR-based stream ciphers. In CRYPTO 2018, Todo et al. found a new property for the FCA and proposed a novel algorithm which was successfully applied to the Grain family of stream ciphers. Nevertheless, these techniques cannot be directly applied to Grain-like small state stream ciphers with keyed update, such as Plantlet, Fruit-v2 and Fruit80. In this paper, we study the security of Grain-like small state stream ciphers by the FCA. We first observe that the number of required parity-check equations can be reduced when there are multiple different parity-check equations. With exploiting the Skellam distribution, we introduce a sufficient condition to identify the correct LFSR initial state and derive a new relationship between the number and bias of the required parity-check equations. Then, a modified algorithm is presented based on this new relationship, which can recover the LFSR initial state no matter what the round key bits are. Under the condition that the LFSR initial state is known, an algorithm is given against the degraded system and to recover the NFSR state at some time instant, along with the round key bits. As cases study, we apply our cryptanalytic techniques to Plantlet, Fruit-v2 and Fruit-80. As a result, for Plantlet, our attack takes 2(73.75) time complexity and 2(73.06) keystream bits to recover the full 80-bit key. Regarding Fruit-v2, 2(55.34) time complexity and 2(55.62) keystream bits are needed to determine the secret key. As for Fruit-80, 2(64.47) time complexity and 2(62.82) keystream bits are required to recover the secret key. More flexible attacks can be obtained with lower data complexity at the cost of increasing the attack time. Especially, for Fruit-v2, a key recovery attack can be launched with data complexity of 2(42.38) and time complexity of 2(73.31). Moreover, we have implemented our attack methods on a toy version of Fruit-v2. The attack matches the expected complexities predicted by our theoretical analysis quite well, which proves the validity of our cryptanalytic techniques.
Cryptanalysis of Anshel-Anshel-Goldfeld-Lemieux key agreement protocol

Alex D. Myasnikov,Alexander Ushakov

DOI: https://doi.org/10.48550/arXiv.0801.4786

2008-01-31

Abstract:The Anshel-Anshel-Goldfeld-Lemieux (abbreviated AAGL) key agreement protocol is proposed to be used on low-cost platforms which constraint the use of computational resources. The core of the protocol is the concept of an Algebraic Eraser (abbreviated AE) which is claimed to be a suitable primitive for use within lightweight cryptography. The AE primitive is based on a new and ingenious idea of using an action of a semidirect product on a (semi)group to obscure involved algebraic structures. The underlying motivation for AAGL protocol is the need to secure networks which deploy Radio Frequency Identification (RFID) tags used for identification, authentication, tracing and point-of-sale applications. In this paper we revisit the computational problem on which AE relies and heuristically analyze its hardness. We show that for proposed parameter values it is impossible to instantiate the secure protocol. To be more precise, in 100% of randomly generated instances of the protocol we were able to find a secret conjugator z generated by TTP algorithm (part of AAGL protocol).

Group Theory
More efficient DDH pseudorandom generators

Hongsong Shi,Shaoquan Jiang,Zhiguang Qin

DOI: https://doi.org/10.1007/s10623-009-9329-4

2009-01-01

Abstract:In this paper, we first show a DDH Lemma, which states that a multi-variable version of the decisional Diffie–Hellman problem is hard under the standard DDH assumption, where the group size is not necessarily known. Our proof, based on a self-reducibility technique, has a small reduction complexity. Using DDH Lemma, we extend the FSS pseudorandom generator of Farashahi et al. to a new one. The new generator is almost twice faster than FSS while still provably secure under the DDH assumption. Using the similar technique for the RSA modulus, we improve the Goldreich–Rosen generator. The new generator is provably secure under the factoring assumption and DDH assumption over ℤ_N^* . Evidently, to achieve the same security level, different generators may have different security parameters (e.g., distinct length of modulus). We compare our generators with other generators under the same security level. For simplicity, we make comparisons without any pre-computation. As a result, our first generator is the most efficient among all generators that are provably secure under standard assumptions. It has the similar efficiency as Gennaro generator, where the latter is proven secure under a non-standard assumption. Our second generator is more efficient than Goldreich–Rosen generator.
Efficient public key cryptosystem resilient to key leakage chosen ciphertext attacks

Shengli Liu,Jian Weng,Yunlei Zhao

DOI: https://doi.org/10.1007/978-3-642-36095-4_6

2013-01-01

Abstract:Leakage-resilient public key encryption (PKE) schemes are designed to resist "memory attacks", i.e., the adversary recovers the cryptographic key in the memory adaptively, but subject to constraint that the total amount of leaked information about the key is bounded by some parameter λ. Among all the IND-CCA2 leakage-resilient PKE proposals, the leakage-resilient version of the Cramer-Shoup cryptosystem (CS-PKE), referred to as the KL-CS-PKE scheme proposed by Naor and Segev in Crypto09, is the most practical one. But, the key leakage parameter λ and plaintext length m of KL-CS-PKE are subject to λ+m≤logq−ω(logκ), where κ is security parameter and q is the prime order of the group on which the scheme is based. Such a dependence between λ and m is undesirable. For example, when λ (resp., m) approaches to logq, m (resp., λ) approaches to 0. In this paper, we designed a new variant of CS-PKE that is resilient to key leakage chosen ciphertext attacks. Our proposal is λ≤logq−ω(logκ) leakage-resilient, and the leakage parameter λ is independent of the plaintext space that has the constant size q (exactly the same as that in CS-PKE). The performance of our proposal is almost as efficient as the original CS-PKE. As far as we know, this is the first leakage-resilient CS-type cryptosystem whose plaintext length is independent of the key leakage parameter, and is also the most efficient IND-CCA2 PKE scheme resilient to up to logq−ω(logκ) leakage.
Cellular Automata in Stream Ciphers

Amparo Fúster-Sabater

DOI: https://doi.org/10.48550/arXiv.1005.3224

2010-05-18

Abstract:A wide family of nonlinear sequence generators, the so-called clock-controlled shrinking generators, has been analyzed and identified with a subset of linear cellular automata. The algorithm that converts the given generator into a linear model based on automata is very simple and can be applied in a range of practical interest. Due to the linearity of these automata as well as the characteristics of this class of generators, a cryptanalytic approach can be proposed. Linear cellular structures easily model keystream generators with application in stream cipher cryptography.

Cryptography and Security,Discrete Mathematics

Cryptanalysis of Self-Shrinking Generator

Characterization of the Least Periods of the Generalized Self-Shrinking Sequences

Simple Cellular Automata-Based Linear Models for the Shrinking Generator

Algebraic Side-Channel Attacks on KLEIN

Linearization of Nonlinear Filter Generators and Its Application to Cryptanalysis of Stream Ciphers

Construction and security analysis of hash algorithm based on stream cipher

A Constructive Method of Algebraic Attack with Less Keystream Bits

Power Analysis Attacks on ECC Randomized Automata

A Scheme to resist Fast Correlation Attack for Word Oriented LFSR based Stream Cipher

An Efficient Window-Based Countermeasure to Power Analysis of ECC Algorithms

Revisiting the Concrete Security of Goldreich's Pseudorandom Generator

Cryptanalysis of Short Exponent RSA with Primes Sharing Least Significant Bits

Generalized Cryptanalysis of RSA with Small Public Exponent

Probability Method for Cryptanalysis of General Multivariate Modular Linear Equation

Cryptanalysis of General Lu-Lee Type Systems

Generalized self-shrinking sequences on GF(q)

On Grain-Like Small State Stream Ciphers Against Fast Correlation Attacks: Cryptanalysis of Plantlet, Fruit-v2 and Fruit-80

Cryptanalysis of Anshel-Anshel-Goldfeld-Lemieux key agreement protocol

More efficient DDH pseudorandom generators

Efficient public key cryptosystem resilient to key leakage chosen ciphertext attacks

Cellular Automata in Stream Ciphers